3f78552edac0b826e412c02c4cefcf51e200585f2be6c8292709b5617e9fee44

Analysis

max time kernel
149s
max time network
156s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 04:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-13_da7ebf7c54857a251d004592934e2ae1_mespinoza.exe
Size 2.1MB
Sample261014-ex46dsfv71
SHA256 3f78552edac0b826e412c02c4cefcf51e200585f2be6c8292709b5617e9fee44
MD5 da7ebf7c54857a251d004592934e2ae1
SHA1 4abb592bac51393592bb3966e55b11db1c3cd07d
SHA512 28b854da7cea09a299bfa16f3bcfddee93afd17de04a132dd003487aa927c3ce80076f74ac83d646e7205cf2c23ffd93d4d05028e46e8ca305f7d02abfcd5833
SSDEEP 49152:oSbrzH5z8LD6XBDmg27RnWGjFarSj8RoTCCW:h2gD527BWG5JTy
TLSH
T1A4A5BF5DBA6883D9D2B1D1F8C212AAE5B1727C2883711DCB83501A1E9F77CF41A3D9B4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4464	elevation_service.exe
6076	elevation_service.exe
2592	maintenanceservice.exe
5160	OSE.EXE
4896	PerceptionSimulationService.exe
268	perfhost.exe
3764	ReFsDedupSvc.exe
1620	SensorDataService.exe
6000	ssh-agent.exe
5264	AgentService.exe
2472	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe

Drops file in System32 directory 47 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-13_da7ebf7c54857a251d004592934e2ae1_mespinoza.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-13_da7ebf7c54857a251d004592934e2ae1_mespinoza.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-13_da7ebf7c54857a251d004592934e2ae1_mespinoza.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\5c0400479600bb.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-13_da7ebf7c54857a251d004592934e2ae1_mespinoza.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-13_da7ebf7c54857a251d004592934e2ae1_mespinoza.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-13_da7ebf7c54857a251d004592934e2ae1_mespinoza.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-13_da7ebf7c54857a251d004592934e2ae1_mespinoza.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3536-0-0x0000000140000000-0x00000001404FE000-memory.dmp	upx
behavioral2/memory/3536-86-0x0000000140000000-0x00000001404FE000-memory.dmp	upx
behavioral2/memory/3536-93-0x0000000140000000-0x00000001404FE000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-10-13_da7ebf7c54857a251d004592934e2ae1_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-10-13_da7ebf7c54857a251d004592934e2ae1_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-13_da7ebf7c54857a251d004592934e2ae1_mespinoza.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a7a0d3a0935bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003fa2ca5e935bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bf9eec5e935bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007868935e935bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dd9ac15e935bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4464	elevation_service.exe
4464	elevation_service.exe
4464	elevation_service.exe
4464	elevation_service.exe
4464	elevation_service.exe
4464	elevation_service.exe
4464	elevation_service.exe
6076	elevation_service.exe
6076	elevation_service.exe
6076	elevation_service.exe
6076	elevation_service.exe
6076	elevation_service.exe
6076	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
828	Process not Found
828	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3536	2026-10-13_da7ebf7c54857a251d004592934e2ae1_mespinoza.exe
Token: SeTakeOwnershipPrivilege	4464	elevation_service.exe
Token: SeBackupPrivilege	3764	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3764	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3764	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3764	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3764	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3764	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3764	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3764	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3764	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3764	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5264	AgentService.exe
Token: 33	2472	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2472	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2472	SearchIndexer.exe
Token: SeDebugPrivilege	4464	elevation_service.exe
Token: SeDebugPrivilege	6076	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2472 wrote to memory of 4800	2472	SearchIndexer.exe	101
PID 2472 wrote to memory of 4972	2472	SearchIndexer.exe	102
PID 2472 wrote to memory of 2720	2472	SearchIndexer.exe	103
PID 2472 wrote to memory of 4136	2472	SearchIndexer.exe	104
PID 2472 wrote to memory of 1036	2472	SearchIndexer.exe	106
PID 2472 wrote to memory of 6068	2472	SearchIndexer.exe	107
PID 2472 wrote to memory of 4704	2472	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-10-13_da7ebf7c54857a251d004592934e2ae1_mespinoza.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-13_da7ebf7c54857a251d004592934e2ae1_mespinoza.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3536

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4464

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6076

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2592

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5160

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4896

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:268

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3764

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1620

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:6000

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5264

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4800
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-696679853-3915825385-3233721679-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-696679853-3915825385-3233721679-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4972
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2820 2812 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2720
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2872 2864 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4136
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1036
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2872 2864 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:6068
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2820 2812 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4704

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 f1492e5fe249bd0bbc79ab72040a6806f2b8a07265144c438952b164f323b0db
MD5 2af456802df1f3d9643ffa246d882727
SHA1 06c8b4ec75bd108fadf187287e51241d9e78b537
SHA512 7216e17e7943c0fae46fa95f658bbadb13eaf24fd49dae1e367000c0573f74c83a140c59c37b0a2c7c3c5e9b68ec1d8ba4d0dc694252a0b4a5c68133d56cec1a
SSDEEP 49152:Db+632BuPkFKRrdE6ohvstBhuXjfS4LWxn/Dmg27RnWGj:h3q6sjB8D527BWG
TLSH
T108D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 75f3ca74e4727b1b6f1cff1a7ac7ee82e3b72491083552d679b37bdf8147f71d
MD5 2dae0f85f2cc836f5174de39215f93f4
SHA1 b3a4c2545943b94195b3a70bf5403fe12e8bab61
SHA512 af4b2b29d17669da83fe9210c0347b992df3fa340a71e5329ab2df7f867717bf351a2df7d60dd10094ca11a9e4f00fd7eb426e2e59d94a5dab67945f973e99ad
SSDEEP 24576:dXYfDtczAksqjnhMgeiCl7G0nehbGZpbD:ItchDmg27RnWGj
TLSH
T1CE650129B3D408F9EC67817CC9A2C516EA337C554760E68B03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 658a4ded1261e4a4d2f6e1833b66ea449cd15fdeb02b83ba07a9116421f03123
MD5 2a56ea22a9d14820714ea6636e31d4c0
SHA1 d1dbe01ad27d07f89fc2f02ec15ad34811cbfc55
SHA512 f00f658af27b7171e91160ebe3a11804f89b5bce016487140d23bc4ae7a8f31caef9379f254bbc3d398bf984ed7708a78a1213d4b4748e0040a1c9d8b3d647fc
SSDEEP 24576:Y0Le5ji0hmxxrMbsqjnhMgeiCl7G0nehbGZpbD:YPji0AjiDmg27RnWGj
TLSH
T1F2859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 6b28b6f71180f089287dcebc6ba42eefc58281fe3699a27fb2665dd61e02f399
MD5 386084facc796eb051d1598f3140210a
SHA1 d362b661e99ff1f69b01c1ccb2294843465a5cb6
SHA512 47f15b477b9ab5db0ea23b46d57b5b41eb459c0c69257bcbdb0e6353996e019181fa221afa9777dfce3f595de5b1fd1e403a7dc9cffd86e6bea46535e49ad548
SSDEEP 24576:la7/ezSC6vUyD/aqgrvWn6q8wyutsqjnhMgeiCl7G0nehbGZpbD:s/ezSC6vUzPveHjyuDmg27RnWGj
TLSH
T185755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 75e183165feae4aba81e6aa039b5f702135007fd2748c12148a87691168ea0f8
MD5 88ab67f6573851407b2c13d00fba36d3
SHA1 84ce51a46c03e84265a147ef89c494e1d4ea0d11
SHA512 984e41333f982353b9bbdf7fcdb04e3cc412500416b0dff3f1c6988be876c49d83e3e7c7ff5e3dd162e4b36be6b201c515955bfb6481b37389725b3f657d2e52
SSDEEP 24576:8VbqPb88hv/l+YUsqjnhMgeiCl7G0nehbGZpbD:8VO88hXl+ZDmg27RnWGj
TLSH
T1E8559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 fb5c662fbc2487ed404eb497e9936038bb61700366ae43f17c322e65b73c0c65
MD5 e6503e9df9c15a1802f6fc75f5b9ce7a
SHA1 07678bd9898897a6c907efc6c2f73f0b9dc12e60
SHA512 ef31ba94328567aa34df900436cc98c84831517075fdebdea8295e05246367b9ee4f9ef2a7e58b203d3767fbe7ef3abaa642e50e621ba0f33cec4cf11c913643
SSDEEP 12288:rL/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:rL/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DD4523BF864C50CAEB7608B5C3E9F11EAC137E56982008536A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 0f44af4ddbc57477bb32730bb7fe4355cccd20dfc64d3a2ee403497388843d4e
MD5 ea38288960ecd1423a61e004a84abfd5
SHA1 3509672f067b3a079c13e5d23d2409f4ef5848c8
SHA512 ab6587031d3abe4805138c29d4694c931848c21135ad773043d842213e8af3e56e7fac7c4d9d44bccecc29a03100c231bf502295f59ac487cf5037fe5afb25ba
SSDEEP 12288:beBNUbTVO86UcXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:bJIUcsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11A65CF7BEE28FCD2C27A8DB85791C600E76278314F61A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 d4a7c9fa28558244e89317881503a2421f967076bef0162d8542ea9c57fb2a47
MD5 404034fd1477608fe0baaaca8c7c9882
SHA1 ec2e1a85857a9b53e803ab9bb1db8d584c92ac6b
SHA512 add4c679a460c5820f239ce02b7d0e435042d883aed62f59d3ccebad35396010c4fb1fe80c01ca57d1f858d06717af04d31fc16c358ce218ccd8b5feac981eeb
SSDEEP 49152:NQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THT:NQvGAdlCEL8c/DRNw5ChD527BWG
TLSH
T1E9266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 5551f6293277b09cc05246e68ffb02600af5d870ebbd4a1a039571d750805f51
MD5 29fe540b721fca39ae1bcdf71e0e1523
SHA1 42007cce8a943e1faa65e6b4005487e2973b15c1
SHA512 2b39fef37716c19c4c96dffacc34de3c7f2dd0666f9f81c3ce3ba61e94590c0bc7579b48cd016a34eeeb989cb051f8069196919ff5766a348eb8229fc82bfe22
SSDEEP 12288:KAwSfxL/2Dc3RDLLmt0LDQewsAjeXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:f0ewsAjesqjnhMgeiCl7G0nehbGZpbD
TLSH
T11A75E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 a50d0df81ac1321d068b3032e1ddcfd4c0d7131a0df47ab0bd0c345ac5478599
MD5 345b5b4e25b7f1f57e289de17d273c63
SHA1 66613eb2088fee26257230d9d73c407a5df20caa
SHA512 c04574a2104f78175963d197478cbeb4657dc845c147c62fd66af6a2ff4171dfb2422fb0284b8cd3a9fa557f925735e6846e03bf0075422502ea06443532c849
SSDEEP 196608:/UEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJH6VQBWG:/UEtQevvqc2W1cpV2tI32NB
TLSH
T155474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 a866f05be10aeef36cbbdf81c1ae3da85135290604c0f475e33f4dbf48b06d11
MD5 d4792b12259cf0c818a8113f2f01029e
SHA1 95eaac8fc2e7cd94a5fec1bfc670d7baad602515
SHA512 399d40e87e5adf05fb20f1727d7ab81a546722ba107456ce7a1a3e7b4d1d441db95c549e9b7a33ecdf8ce0844e99ce257df703bd39da6ddf33b4b4fa510bee6c
SSDEEP 49152:4CbRquA/m2yL5zTfFiV+XenmE3/zSDmg27RnWGj:xoquVjnmtD527BWG
TLSH
T1EED58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 2cd8df0d2f271ce1ba392113e242000bd8b59b597d0ae568fb0c7cdc115d4c8c
MD5 f8a4520ba3cb9859149d71e03bb35704
SHA1 fd9aa8230d8d19b8968ede6dd7d2f14dae325a07
SHA512 cab18791d898b322061a7a69c416ed9247ce4fa4e3de5280edfba941d4b663cba15379cd460f951512f560d6e6348a244b5be5735a287ad4aeabdf5fceedd708
SSDEEP 24576:FAhGL3IFoiwtA5l7S53JsqjnhMgeiCl7G0nehbGZpbD:FAMUFoiq59Dmg27RnWGj
TLSH
T140359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 35f1bebf663430ce91bfca2dcc0a41d207ee6e3e5cfd8c9da206faac5f62df1d
MD5 c3bcf7e25ec025dbdc029d9314415824
SHA1 e68ef69544e184874152d50f8d9936cc3b3f04ea
SHA512 4e9676be7a09c16a1ac4510b8c96bc05431f337d2af075bbcab95d0a1f505499640483681dc4a8ceda09350bca3e18d40ba57616254d3f85ef054cb7a92e89ce
SSDEEP 12288:2mw5HEjsChNVBFgl0WDm+CtXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:vwu4OWmsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FE65F14A76A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 a410b0c410c6138c38de315fddaf62c8e59a71122778ffb7cc65ab0195ff63c9
MD5 54f8383fe13deaab9a8c97e9f9670dff
SHA1 f86e07c2258595b2e8a9264b5b45c38e559a9d7d
SHA512 7e840e8b9d5cc5027fe688aec3d2eee986df56303a034ecd1fcfcc4302406ae9dc6d7d6ffa5c08f63ff74accdb298fd9adae78b78977fd876d2dad4389b655bf
SSDEEP 12288:reZ1IyuXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:KZujsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F05512AE239820FAE163417CC5E5D609E7337C62673003CF16665AAA6F739D44E39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 d3fc988a6eca1723841d670c0d245c7f86ab32f387d427211ab5acf7ae37141f
MD5 f287ab0c0b586607a4fcb6905afe1c7b
SHA1 2ad4f6c0a0b46a95b09a2505066e48289fecfd97
SHA512 a13afb18c9dbf405ea20dc7c61f7a11dc306103d889317b9d7b07c20894f268569e33078bdb53f10cdea0e151347a6580af864ada73230e3e2c936a17cded4f8
SSDEEP 98304:JQRQyi36YOcPbLvw2gAf+PN30D527BWG:gQyiKa/X+PNkVQBWG
TLSH
T144667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 7a91f690577ca33de8d68255d8674fb97ecd5a1a1a5d7868d41f673e134e66c9
MD5 927825c36562fb8c66715f4dd95b6a1d
SHA1 efd2d15c998471865011666d51dd5811558efe4b
SHA512 70aee8ea8b8465f5ececf4b248698580ea946b9198efdedcd35da752b516cf2839f927e236d15a7fa430e65b5fdf04c461f7cf8dd8e215a8cca1a5a16b73da64
SSDEEP 98304:oQRQyi36YOcPbLvw2gAf+PN30D527BWG:/QyiKa/X+PNkVQBWG
TLSH
T15B667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 165aa0f5b810ffd4b4fc9aef9c2238f8d76a4da97ce28c4b436fbe4f01bc685e
MD5 99ed25496adcbfb528f88167c766ff6a
SHA1 639250141bf626692b3e2fb2ad3d62c7cbc8fd5f
SHA512 cf74edf8dc8e95581a24d116b5f5d60cc201a1ec7e5758a33c0db87ceec3cb97faad3507674dc7981ef2456381531f516d470223bfeac96bed0afca72435dbcc
SSDEEP 24576:2wvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0TsqjnhMgeiCl7Ge:g68Qg55nhceWu7PNU3/iDmg27RnWGj
TLSH
T18CB55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 0574e2be03e5ff9b73524cfa1840ea03daa75ca4f6ec2aee1f3b2bf76ef6af84
MD5 a10c0054fffa732460523baf08fa1c33
SHA1 3398ab2082fd678961bc66a04850ccc146a224b7
SHA512 8afde994239f855f0b9be384eb35d426ad751472c3626ed55dfbcfba847e804da414f5d75fdf26bd264ffcd410571712cdfd6b63e8f7429cd126fe52dd90e568
SSDEEP 98304:Ny5112gYy5azzVvt69nLKnhZjD527BWG:wLIHEWhVVQBWG
TLSH
T1CF167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 1b8055d6c8a4b6add0344d779afeb2fd3e5c293b9baa62b6e1ec021f0dea9c1e
MD5 c2ad9a01850167b473a9dc223ce27861
SHA1 3d6ff7422c0522811ab305231a4b97176fa9b482
SHA512 e7327e10f982dd98239b7c1c62970498ccde8c10e87498a2833d43f816ba4d0d9a9e80537cb49aa64d185aa4cebbc2bd5436b39fedb8566ba15e6ac823d07ed6
SSDEEP 49152:nB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glwDmg27RnWGj:pu6Jmdxd2dwD527BWG
TLSH
T1E4D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 0f05bf49cf762009c42f6a0906d6ec938602df03f24504ca33097f9d0142296b
MD5 b522272bccbe3359491d8adfd25cdbdc
SHA1 657a1b250756343c687ef61953b3a62e9e6dda9b
SHA512 8bdc272aeeccc8e57d4abd81a9b42b618d8fbc6674cfeee671d19daec94132ac5322722739f90f840dcacb049279a83b86a67ae2ae838924ae7c492429106b0c
SSDEEP 49152:T1hpsNoJpF1A63U44CwH7R4xoDmg27RnWGj:TmifPWRtD527BWG
TLSH
T137B5BE13F2D801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 a8b8a33f1e660dae7cb99ce03cb4049391b2a202bb0d17f6b4fa3cff418c843a
MD5 537a45251f46f7c0a035a4d848143175
SHA1 a71328535bd8bb9c46340910d7868519e87e5475
SHA512 0dd6fbe1a869cd63b8dd473b2b09bd52a4738b818a9ff9047a22ac15636adfda570c8453273579c033cae9e136cc0dae1552c0efd2bfa2b47d4e92032615c2cc
SSDEEP 49152:hSuZQIY0Be2KcRVtOnks6NMHqnDmg27RnWGj:v5dKii61nD527BWG
TLSH
T15DC5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 041cea7cf4b604f3217b0a1741372368bd471890905041458e60c159d8bcbbcb
MD5 908e1171979933b42b396807188ffb41
SHA1 c12707e1a2b74ed780d4bde6b1c3bbe979c93748
SHA512 f87b3c9f06582c5f310faec147cf28ed29cc567c266d0d84563e1fcce14af9f52cacc12ea0c5e92529bf7c824496fa3a0c11b603f031c829f474154f103daeff
SSDEEP 49152:xhtSn8EApI0fig3giDn0AP5wcDmg27RnWGj:gX2imphpD527BWG
TLSH
T19A95BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 6259fa2abea29eccd42eb393cced01fd583d8af7a9f9c1f7c7725029001eca9c
MD5 ee6a90a9951ec4c7ce5469b5780cc0c6
SHA1 c94c7b455b027418a17214af6a9dcef57a98eaed
SHA512 05b9fa08211cc1aa33a5f48059d674ea830fcf527cf1ea39364be2214a508598388ce439a51b95966fa7fe47cddfaf7aac20aadbda980ce7528f0c03dec870e8
SSDEEP 12288:/HXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:/HsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1514523BF965C41CBE52648B5C3E5F10DAC073E5BE92004937A977CB9EAB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 e3602748105aefc8ac7488fb9102e80ee47a5a4e91b40d43204c65f0a082d07d
MD5 7e9803881d70daf1122c66bdc9b4b3be
SHA1 7962b7b9c689e13e6fa6dfaec0cadd7d174a545d
SHA512 35d74d67bfb21608c98afab01aa55867e9f5338ebf382d8eeb87bb07e1147bfc03e8e002ab2fb5a4728bb077e7a4e1f0f4d4e0689aafc429ed7818647fc995ed
SSDEEP 12288:kSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:kSsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1624523BF965C41CBE52648B5C3E5F10DAC073E5BE92004937A977CBAFAB14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 f2232b16c67d9fac1e4745d158c7f8cf6d2166e5ed4632fbcf14467d38d85e7b
MD5 334ab2d07dc7a9ca397cb5c90d74cc14
SHA1 5541cd00dda0b50d720c2c00fdb43e1dffbaefc2
SHA512 02418248270c37e73caf0a050f32864f7a96f477b9af936fb732a3eec267dc8a1fe0de7e44b51e07c9b75ca9af942ec04fa04e58e83329802d3c6911d9c74108
SSDEEP 12288:LEXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:LEsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1404523BE965C41CBE52648B5C3E5F10DAC073E5BE9200493BA977CB9FAB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 363ac1a8440913ce9bbf7c35d465f26841d31a14cf002359850ff0638e1a8f81
MD5 3d75ef84c0a4492eb0eb1e358fa5bd7b
SHA1 a40723110d358aae4016e1ba3dd0041ba6adfbc7
SHA512 e7ce4b7bbdcd88c4de3a18f686fb51e0fb12e517ca43bbcbc763c04b4a9b0a722360d6783ac8cf07892a66a10c7e24c75af04c6691c8b16235efb790e8175120
SSDEEP 12288:AVpXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ssqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D145236F635C01C6D83285B4C2F5E11DE8277D96EB3005DB6B532CAE5FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 734904360db6697918dfe7810fc9a1b9fa4fcdc279fa68eeecf51ddf394e260e
MD5 00e1d4164bf949fc1debd005ad12ac3b
SHA1 d521745fa586a03c2fd8c05c65efbeac624edec9
SHA512 53b982397a61deb36a4c34afbffae5ebd3740671b06004911d98f60f092275ae1b24e8ef1e367e596c7a2e607f42d2b0db3804110c47541720d2bf4c30fd58c8
SSDEEP 12288:9hXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:9hsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13B4523BF955C41CBE52648B5C3E5F14DAC073E5BE92004837A9B7CB9FBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 9ccb84d32fd33bf180b96c75ee4a863ebeb35722300070b9b3d62f146a27c3fd
MD5 b5e8f4e0cbf421a12c11aec14239ffeb
SHA1 232ea028de947e1d0ebc1d54d0f99b8968849cdb
SHA512 cb73274d4ebaf06ff61876257196cc53e9b36878d00951ce4e60292fe1a831029df0d46e0d631e4b29e4d133e10cfd8b47b9c5ab8aea3ffc90d76580a531d725
SSDEEP 12288:TGXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:TGsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1464523BE965C41CBE52648B5C3E5F10DAC073E5BE92004937A977CBAFBB14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 a287c76c2942756dc304934050609b6b226762abb78f66e82ef76069c8c29866
MD5 624f4435e08812fe5e374fc5176cd6c4
SHA1 8724f5eece51336e10a4b8a1933257c65a7a4b5d
SHA512 e61120628cd6de9739a0715e67aa257549e094142e45ae5e4aa043d2030462835a0027a2e419ccbcebb43745e7eb1c7e7bd850c03a6afc78cfe37a67e6e9844b
SSDEEP 12288:oqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:oqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19E4523BE965C41CBE62648B5C3E5F11DAC073E5BE92004837A5B7CB9FBB14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 d928270f7969c0576490253477be5d9440899ef92a8240d079416d587fd0a23e
MD5 8f1700f13aab977deee73ebb2fceb070
SHA1 285a60aff3cedfed319265b384c85fb7cab70186
SHA512 f34e3ba62ed668f780e032a604384b8f2cb64f15f4933b967b284d4e359f8bcff070a078fec243d495e74402dab1384112e36b8461e0f0b8639547155cb10607
SSDEEP 24576:pZMRzFVSOysqjnhMgeiCl7G0nehbGZpbD:pZMRzfaDmg27RnWGj
TLSH
T1C86501A9B39418F8EC63813EC965D90AD5B27C5A0B70C61F13A4366B5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 0ff39a98095a6064787683bab3d4d7d6bd6f67aaf75f532d645d28643148e663
MD5 7d028801ea2ce1eaa80caeec8b0814ab
SHA1 3725f9598c354450855daabca56595d9005a8c4a
SHA512 535a72945cee43afc1fc5c0525db4ae6c8dcababdbe5983e4314379a7ae282a2644cbcba4b0081235cc78cd9dfbe609ca84f2fc76f7a2eac0a5b1e18b3ef41bc
SSDEEP 12288:7zXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:7zsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B94523BF955C41CAE52608B5C3E5F14DAC173E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 8abe218465bde69dbb1d32177bc2c561d862165f0b99a3b97e56597d53cd05b7
MD5 8679cff0d8740cbdc59b58d82c5038fc
SHA1 f7ce0417fc4815e82ee284fc13ce7f5f45305738
SHA512 1d231067008d8a42cab02f8c70e1ace4ef9f8af1d0b64e9857214c998350f2bed29acdf543148aa0f0c671714f7cb46f707f70a8399592ae79983ae146c13db3
SSDEEP 12288:iPXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:iPsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DB4523BFA65C41CAE52648B5C3E5F10DAC173E5BE92004837A5B7CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 4be515e95d67247eb66f5da64e26677fbc72337700c0eaca0c232ba6b2aa3f79
MD5 d69e78a24c949da620f7247f4af011f3
SHA1 9f52524b5a1bb4221e152f17f92154a42e5d6966
SHA512 ec4676fdf204418824a857cc9a736598cd8262f8aff49881fcc628343dfcbbbe0aea28da03a8c5aad4635bbcc3b9bba9905570e80231205bb7ecaf28085a7d6b
SSDEEP 12288:vyPz5L8uXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:CzyusqjnhMgeiCl7G0nehbGZpbD
TLSH
T11355125B73A530F9D1368178C5A29A06F7337C3647204A9F17A116BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 4fa67b0a46223793e8ef341db57aabab03a96ed5722c1c4866ed61f9048d3008
MD5 37915c7a1b2920582b860610439368e9
SHA1 6c7d6bc2e9bcb3721e417f75e649d4e34d59f436
SHA512 d00359d533f0ab546ea2b324fd56a1797103f80ce7cf292c215c505d68d71208bd48700396d9f09845725433f176e8bd19d8e7cff484336a9eddf4f62cb89f92
SSDEEP 12288:9zXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:9zsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EF4523BF955C41CAE62608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 e4ef0ad3edc982d6029298aa346bb8684ea3574b51b21712b43b9cd5079798b5
MD5 dd16c7a62edef664c1a388ec3651c35a
SHA1 78dcfb61cbbf0192f563e88d75928577b5a74a6b
SHA512 c1f9912ade08563cfe5089b1750ec160a943d5ba98a1b0bf6e0278e539ace95ecaba071e78ffd38b89f8ac8b9510234a0b6b7845277ef665e224ba7784ba79e9
SSDEEP 12288:yzXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:yzsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13F4523BF965C51CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CB9FAB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 3cbdcf0a390daf8249212ca9fef91063dee33bd5945c13be2071d5cb5c455e6c
MD5 cfc650ee012caf40c01114c21f34dd13
SHA1 9752ab7949e2e2572e9caa9d8085471ffb8e8627
SHA512 0f9835d74ba8aae8378844af03e3ea9008498e5fd3f6901a5183e9b8b2ee31fa8fcf833d6ff93aafb7039ad0edbcfd1afac9b06061646c5a24a4fbda5f28d902
SSDEEP 12288:2yPz5L8uXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:LzyusqjnhMgeiCl7G0nehbGZpbD
TLSH
T11F55125B73A530F9D1368178C5A29A06F7337C3647204A9F17A116BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 7127c4311eb054294032c194f988879e9976bbde636808ba1ecb0cce43b84552
MD5 94a330d963b23d12ee4016c3d66d9e90
SHA1 4bf32b7a0902fab5f493153218fc20ee6ed451eb
SHA512 d25f04b0ccf1202759f60bc54e2815f9d1e5a9fe4d7bc98126048fd76527c45d0c33243149d9a49b25e358135f80905d5994b2da4fd302a94571e5125d4cc4b6
SSDEEP 24576:NTDaLl3z0zD0sqjnhMgeiCl7G0nehbGZpbD:NTuLljRDmg27RnWGj
TLSH
T16D6501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A53A6A5F333A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 25dcae71e643e04b3531fb5a20450580e92a7c1ecdd5ee29ac2ee8cb69e1d163
MD5 854e64eb0f5304c6acc2c552ed35cbc7
SHA1 56ab3038e27d76373128b0a7ee4813b2e29ff384
SHA512 90c1f83e304050491f874ef9b1c2773b0c1412951fdf0c2a00b92064c23f8ab10ea82651f39d7c8dea431a4661329003ee7493abba8bd800eaee9ed50911785b
SSDEEP 24576:n3vd9CHKy7GZosqjnhMgeiCl7G0nehbGZpbD:3vd9CHKyaaDmg27RnWGj
TLSH
T14375CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 56fce56cfa7a6d0135029972e34917fedb85279e8d2d8053a17ef73e5cd1c2f6
MD5 bd3718290631560199b47b8326fb2f78
SHA1 683350433903f48f883bb3a1b232e965fb4c71be
SHA512 da74f9c9b97515946de4172a94a3ccd5a035ff0d509873c5720027d0440535c88ebe42d55f2364e58fff2060779f4715c37206e4840a30816210a63599ef44b7
SSDEEP 12288:NkXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:NksqjnhMgeiCl7G0nehbGZpbD
TLSH
T1214523BE965C41CBE52608B5C3E5F14DAC073E5BE92004937A9B7CB9FBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 66fdb07d25e553466c79009aea0cff44f3eee6cab93fa7bccafd5570a1ee96ce
MD5 63d968a6bc58565cfb1e9aa0b60ab88b
SHA1 f89ea4e2031488278b8ad337687e96b14e69ed51
SHA512 7f842279489162f1d6638527945b3ae2f701f1b7f98d99ec42aac410b3e12d3797df5425584927ca481cbd1e1d2e8f7711ba2a865a459bcbd5ac51ceb7bb36bf
SSDEEP 12288:xOXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:xOsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1044523BE965C41CBE52648F5C3E9E10DAC073E5BE92004937B977CBAEBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 09a3f8292c59d14ec5dfc5f3843b268b114fffbd119a8ba3476401642265d80d
MD5 922d8dbeb2e34e2f09495db7ceab0945
SHA1 388aed8b3243386331d5850ca7c99f047c601a49
SHA512 92c1191acde832edbd6daef5e8aace8466ffc991a9f7d6e2d9a9b0e318ef0e0b61e83f0e8bc5db236760f2a9ccf336a5b1d2d1d0bb781c004a1052cab7f5064c
SSDEEP 12288:IFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:IFsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1394523BFA55C41CAE52548B5C3E5F10DAC073E5BE92004837A977CB9FBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 4860ba07d61af0b7880c4fe8c9f2a595f9893fabe39016e12f96aa0d2f0209f9
MD5 8981ac8740f3ef3bf32d23fddec50b24
SHA1 16e6201b97f1412afb0a4d8ed92e5457695edafa
SHA512 de8ce10a2b4ea026b2ace5e0dc4ae9487cffdc61191063fd47bdc37392608b7003a60b17c9501971945f564a2060a2e8462f5e8884cd5991e503f4a18d0d7361
SSDEEP 12288:6zXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:6zsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1214523BF955C41CAE62648B5C3E5F14DAC073E5BE9200483BA9B7CBDFAB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 b136085dc4b12a220aa04777815cd53245b6e4b0e8e342b44296939b5fa3e14d
MD5 963b465519650af5bacb48130593ece6
SHA1 5fe5f1f7e6662b370fb19b77f9e32491e7dca6ae
SHA512 694a5693274bb9e1e92b80d6e6348e6246e02bcbbb8aaec7c7f79a71c8384fdcbf205eba7d2d8b9cf493a0ce4aa5da1bf8f524c18dbc932a5f4193f34616bb37
SSDEEP 12288:9kXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:9ksqjnhMgeiCl7G0nehbGZpbD
TLSH
T16F4523BE965C41CBE52608B5C3E5F14DAC073E5BE92004837A9B7CB9FAB14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 319c0890325f2c4d3bd842ab15743d23601e8a2546eea432d6a7c91a25efe202
MD5 a8ca43194d4814542f8cb053a0a4bef8
SHA1 f51f75e564dfae4ee4c2baa6b8eb9e8d7f72db17
SHA512 5b9da991d993b501998e3d9e5427dea882ffe96fdf567c686380069713c02ad75f2f56aa86f01efff2bba7de2e20e68ccb999b99fb3c66ae1d61bef0175c9450
SSDEEP 12288:nLXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:nLsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10C4523BE965C41CAE62648F5C3E5E11DAC0B3E5BE92004837A977CB9FBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 092246932bdaf6a0bbe6c7e44e22685a092cf0abafedb77e91350d6c8836a4f7
MD5 8f08762b01f43c7aae27c0c332453c3e
SHA1 ddddaa77d02e55752e340caf36ddcba49d86a59c
SHA512 e6e5d91ef9479928123a7426506a8f39335e72ad1972fb44bfbf02d8a988edb3b1375774afd07e1c0dad73c4a5cb6f81235ac6e299af9d82065b8af302c1a0aa
SSDEEP 12288:HhXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:HhsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1024523BF955C41CBE52648B5C3E6F14DAC073E5BE92004837A9B7CB9FBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 7a3e8e7ef8a8c96736a206327e1d59f8ec6cd3d29c950515b2e931de7a898c8d
MD5 f500618b4f0b7ada96492f4a601d9803
SHA1 382354ac7e5f2c8c3b6ad04c2b5815e6b8dc85df
SHA512 2045d4c6d9996af4cf4658b8a17f641317f2d87dfb557a64083fedd504db4492afbf60f0c088703b2864ef59e22730de66ef1076fb6f30db4bc1e4e82fca886f
SSDEEP 24576:dfwvUk9RX6wkyAIfsqjnhMgeiCl7G0nehbGZpbD:PMnYIDDmg27RnWGj
TLSH
T1E085D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 eed7e7aa505493d69686253d8776cfb7aea575f66525021eaa326129fb8ec17a
MD5 53f47b6073e1f9bb770664abed77dd1a
SHA1 3a646fbf2d7481e491f7bc42d3379805953205f6
SHA512 670d6b829042db50301ee66fdbbdb7cde50e0c832dd2fc7ba3de3f7f37cf8ff70ecbd18394bb12ce01f9614d75300714cf9f882dbd208a2842cde58c72099365
SSDEEP 49152:mYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK08Dmg27RnWGj:lySzPUD527BWG
TLSH
T194066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 4f4bf3a6415c9464adb7b91a54d41d759e98e055d5c459ddcd70e814c4b79806
MD5 5408c5e9fa40063b378c73f3ac0fd2fa
SHA1 57b4992e45bc4e037ef01126e301a409d82636df
SHA512 f7518f6bd73a6283bae6811a63b256e2a79673324c1959fb7733d816f9ca07e50ee400b3c6a40cd9bba62c55b43270978c2624d245ff9eebd6e32ef7687e4671
SSDEEP 24576:D47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYCsqjnhMgeiCl7G0nehbGZpbD:D47JUQjTirIhCnDHUPfF/MDmg27RnWGj
TLSH
T13265AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 6e8976c4a08d53c53e3d311817dac6e02631557a8e160bd8230b999724a31cc8
MD5 5f917c6bbf91ff007851d5e74d2d8644
SHA1 e91428187b8c81cd419a4e5d326e843cd07215de
SHA512 c61b60e6b04c5c581a80d6d15ea65b8597b5a2db0685f5efca9ffecf2b9e22779a2c4ed55588fc205c99c3425df6d0f6e88061ec87a100996a915b5412741647
SSDEEP 12288:LbsfjXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:+jsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10B55011AD29802D9C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 d9b0f6b4a5a352b676026811abee0e47995d03179bccb59ad879faf5a6894243
MD5 af6e7d40f8a42aeeab823a68b0b75315
SHA1 992bf58b4d6b00eb44bc779303065d1a7420e33b
SHA512 a572f38300807a45c354a914ea07459fa7e9f19548be454e9110c09fd97b67c46bd852ed532018f76ed0c5732996868af8a608bbbf8c083a5a6233d384744d83
SSDEEP 12288:zt7ykIU3f+wXKOYkJ/D8WT8G3dpG8L1mURK:zt7yRUP6u/z/dpbL1mUc
TLSH
T11D3518007626DB4FC6A940322E76D6CCAB707D42EE099F1772CA473FC576658B6F1282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 438bf92a7aa03ccf05f099d7066e4410d35d61d27c8a6d112085e5c9dffec8bf
MD5 4dd1b65f78a82527aeeec8718b57eebe
SHA1 f91b38a610dcf96dbb7e1196f7253275c445ee92
SHA512 778fdf9d3e31bf4b3437e311300e66612bb24632ccb6e04c45fe40e97f523e16a3c9dd19a775ab43782284e637c990da6bcd7e786d2834fc4ad92d0e30dc206e
SSDEEP 24576:9VllDM/W5wD1uXVHelGs/perAG2ih3MePlNt+Gtsnj89Ph:4JuXVH8nj89Ph
TLSH
T1FA655D416537AB0FC5BA8033433699CDABB4EC06FB493F0573884936D8A6A09B5F67D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 4a57999373993a7f7010e134264e91848da7f553740b0b8097e296426793c04b
MD5 eb6bc0039208114e019ff57a9dbf8234
SHA1 69554d4794ea859b607e034dc15ca1c1d5d443fd
SHA512 29f9cd97004bec2b3559cd8f3da9ce974282c5b634c5f782e333060e5908c7088f4736215ba52f82dfc4315512b66797170053a1bde07f875893c92874ce1e9b
SSDEEP 12288:0077Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:J7sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CA45237B934C518AF93609B482EAE12D681B7E669F1004C3B94778FDF6B18D88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 257bdb010dc0ecb2d87b4fc9732829380a4962b153401c84a92625755d3de1af
MD5 e49d2a1228b0f9749f155f3fac2552e1
SHA1 d41c644e83a91c0eca8ed773c4d86b4ca86222a7
SHA512 f1e48d8f9b2eeaf4abb7b78f3d118ae57ba9c71de81559a1cda9321bd1735b6ddab8a7180a3a5e24ffb48c8f1c7fbfa5c70d5b1d3c73a663198f46751d608c71
SSDEEP 24576:ggb6bmBIi49WNNFpg1rSvFv7bYtsqjnhMgeiCl7G0nehbGZpbD:ggb4mBIBhGFGDmg27RnWGj
TLSH
T17D659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 13ff08987e346c03358c3c7240a6c95905c0046b9153ea67efbfea2d455ff6d7
MD5 180670be0d66b70212c191008400027d
SHA1 2707d6236f3fc268cfdcdc342917c34c9fca37cd
SHA512 a1afbe4e44c36c6d2adcc780d39988f558b3b1ee5cd41e3b6e0a7a3d908f49033b1e4cc6d321429a499e519143b1fe5b8e3d35733c9aeb18c895b88d13807c05
SSDEEP 24576:+G88u8FpJqH1bzria7/mysqjnhMgeiCl7G0nehbGZpbD:V7ZFPqVea7/ZDmg27RnWGj
TLSH
T1B785016577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 bf3e9f416ea8a537672e07094b1a6d8edd39e9a2712f38e4e266d78a85c6f978
MD5 afbe96c6973c96be5e8546bfd0984f15
SHA1 fdeb01c73c93aeddf50215624bc27779e6e6cf9f
SHA512 f3f6dadb4e3918cc46f6c9aa2b7b153092d72046f8ef5c6b50d447bb7b25c445649fba06e129911b90c87e9d933f31dacc5d302a49fc16b084a48917e5a52549
SSDEEP 49152:iBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjKDmg27RnWGj:tG05lO43brD527BWG
TLSH
T139D5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 76be0984cc196993cfa6d5a5c45539c7c2b8e69a1d585eaebeb46ab9a5d85fa1
MD5 ea69978ffc94dc75926739f4f1fac0be
SHA1 f9995ce8b605729214dafcbc57a0cbdd736aeb0c
SHA512 eb51b3cd9bb99549c13c0dda3659829b31dbede05fe075f1851f9fcae350589f6d64a8b6ce72360554d9033fee931cf5f4711a432408a0bd873b86f3076599d9
SSDEEP 24576:jfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnAsqjnhMgeiCl7G0nehbGZpbD:ba5POZ3BJt2pasx2+miDmg27RnWGj
TLSH
T15465BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 3a77a085564e8257b8bbaa923d3c4e8fcadf4acb7f28694c26a1939ddcd29ebb
MD5 40974204e710ade72a1c8c934c02a0bd
SHA1 b3f3069fc2d6d749ffd71f41559628cbb0203db5
SHA512 84f1c7b56e61fe7951ae7f1ac86a6c678381e3f75f26afe87c33ff786fa1d93db920c8d7dff47a42a02944d8a4506fd9eba12e9712d3c7d48c6d81d8d0dc7762
SSDEEP 24576:tNcwHdjbyQ4nLC18lb/EOjowL7FkasqjnhMgeiCl7G0nehbGZpbD:tNc/zEOVHF5Dmg27RnWGj
TLSH
T15C857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 b5e0708c829d307ad3f5d8471663f4eb40d5288346302bbf1c07d94732986458
MD5 8cdc46367573c1fe7a1319e14a17ce05
SHA1 e2b2b7e476cfa9962ec5897ce1a8bfb533f40358
SHA512 c86dcd678a203975e9098d45fca0792c2d887cd7333d15435c7a6a7f7cabfa4dc42aef66b9d9ab029c6f0787182fda2d3538813735f4f3dec64f2df6fd947b40
SSDEEP 24576:8TkNvNnaFeYhJNtmZBmIsqjnhMgeiCl7G0nehbGZpbD:8TMwBtOm0Dmg27RnWGj
TLSH
T1BC55AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 66108a58a074ca1824aa9b6a759a292c51243bd104c1d5432a0e313cdf51bff1
MD5 a91b99229b8a5f7fe3ec6d974bfc8b4f
SHA1 9146403e256018df38fedab840e1fbac61d84fc9
SHA512 72b7f718ecbcee8c410c872072d12e8a325a52421539b644d94f8ca2edbd4fad839892ae17142f8b106d89da30a3dea97019e3dde5385c7ecc12f39b1d30812e
SSDEEP 12288:GHvUrBFrEjwaQ6Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:GPUr+NQ6sqjnhMgeiCl7G0nehbGZpbD
TLSH
T12065F12F22AC18E5E676A17DC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 602db059dae1ab73dfd3bf9b421ed6b7ada63adb67b09031c0c8bdcaaf32a946
MD5 8f38f188c2d28d65ce01ea534b3f2991
SHA1 3447e8caa52c5475e141d8cc2d190d7b758df597
SHA512 d4cb4b0c888683c048b6ebf80e5a191f3c5adaf5c34b08a3ee0d8a1913a34f17407a43818f0c8818ecd98c8c966f5b7fe01c65683572c688248ffff1620ec996
SSDEEP 24576:GD3FHshBIYQgAnsqjnhMgeiCl7G0nehbGZpbD:GDVHeBIAA7Dmg27RnWGj
TLSH
T19F75E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/268-99-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/268-300-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1620-324-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1620-122-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1620-326-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/1620-328-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1620-123-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2472-157-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2472-329-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2472-164-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2472-158-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2592-48-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/2592-80-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2592-58-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/2592-47-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2592-54-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/3536-95-0x0000000002940000-0x00000000029C3000-memory.dmp

Download

memory/3536-10-0x0000000002940000-0x00000000029C3000-memory.dmp

Download

memory/3536-86-0x0000000140000000-0x00000001404FE000-memory.dmp

Download

memory/3536-9-0x0000000002130000-0x0000000002190000-memory.dmp

Download

memory/3536-0-0x0000000140000000-0x00000001404FE000-memory.dmp

Download

memory/3536-94-0x0000000002130000-0x0000000002190000-memory.dmp

Download

memory/3536-93-0x0000000140000000-0x00000001404FE000-memory.dmp

Download

memory/3536-1-0x0000000002130000-0x0000000002190000-memory.dmp

Download

memory/3536-18-0x0000000002940000-0x00000000029C3000-memory.dmp

Download

memory/3764-102-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3764-342-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3764-340-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/3764-320-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3764-103-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/3764-110-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/4464-23-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4464-30-0x0000000000E70000-0x0000000000ED0000-memory.dmp

Download

memory/4464-24-0x0000000000E70000-0x0000000000ED0000-memory.dmp

Download

memory/4464-109-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4896-216-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4896-81-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4896-74-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4896-72-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5160-181-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5160-61-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5160-62-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5160-68-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5264-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5264-142-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/5264-150-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/5264-152-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5264-148-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/6000-136-0x0000000000960000-0x00000000009C0000-memory.dmp

Download

memory/6000-130-0x0000000000960000-0x00000000009C0000-memory.dmp

Download

memory/6000-128-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/6000-325-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/6076-41-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/6076-121-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/6076-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/6076-43-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/6076-42-0x00000000006E0000-0x0000000000740000-memory.dmp

Download